r3.4 Protect cryptographic keys with AWS KMS
Restrict access to the cryptographic keys used to protect account data to the fewest possible custodians and store them securely, with separation of duties from the data they protect.
AWS services
AWS KMS 
AWS CloudHSM 
AWS IAM 
AWS CloudTrail Requirement 3
Protect Stored Account Data
PCI sub-requirements covered
- 3.6 Cryptographic keys used to protect stored account data are secured
- 3.7 Key-management processes and procedures for cryptographic keys are defined and implemented
How to implement on AWS
Use AWS KMS with customer managed keys (CMKs) for CDE data. Restrict key usage and administration with key policies and IAM policies (separating who administers the key from who administers the data). Enable key rotation. Log all key usage with CloudTrail. For cryptographic module requirements, consider AWS CloudHSM (FIPS 140-2/3).
Practical implementation
How this control is implemented in each reference architecture:
Use a customer managed KMS key for the data tier with key policy + IAM separating who administers the key from who administers the data; enable rotation and log all key use with CloudTrail. Consider CloudHSM if a dedicated FIPS module is required.
Single-account, 3-tier →Keep KMS keys per CDE account (no shared data keys across accounts) and separate key administrators (security team) from data owners via cross-account roles; CloudTrail key-usage events flow to the central log-archive account for review.
Multi-account with a dedicated PCI OU →PCI validation
Testing procedures
- Examine key-management policies and procedures to verify processes protect keys against disclosure and misuse (3.6.1); examine access lists to verify access to cleartext key components is restricted to the fewest custodians (3.6.1.3).
- Where key-encrypting keys are used, verify they are at least as strong as the data keys they protect and stored separately (3.6.1.2.c).
- Examine procedures and observe processes for the key lifecycle: generation, distribution, storage, cryptoperiod changes, retirement/replacement, split knowledge/dual control (3.7.1 through 3.7.8).
Evidence in AWS
- KMS key policies and IAM policies evidencing limited custodians and separation of duties.
- KMS key rotation enabled.
- CloudTrail events for key use/administration (Encrypt, Decrypt, ScheduleKeyDeletion).
- Documentation of key lifecycle procedures.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 3.6 — Processes that protect cryptographic keys used to protect stored account data against disclosure and misuse are defined and implemented.
- 3.7 — Cryptographic keys are managed securely throughout their lifecycle (generation, distribution, storage, change, retirement, and protection against substitution).
Learning resources
- AWS KMS key policies (doc)
- AWS KMS Cryptographic Details (whitepaper)
References
- AWS Security Maturity Model: Key management
- PCI DSS v4.0.1 Requirements 3.6, 3.7